HHS Proposes Overhaul of Information-Sharing Requirements for Addiction Treatment

In a notice of proposed rulemaking released Nov. 28, the Department of Health & Human Services (HHS)’s Office for Civil Rights and the Substance Abuse and Mental Health Services Administration proposed to modify certain provisions of part 2 of title 42 of the Code of Federal Regulations, commonly known as 42 CFR Part 2 (or Part 2), to align requirements for patient records regarding treatment for substance use disorder (SUD) with those in effect under the Health Insurance Portability and Accountability Act (HIPAA)’s Privacy Rule.

These modifications were required by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020; other proposals, while not expressly required by the CARES Act, seek to improve or clarify existing regulations in the spirit of the legislation’s intent. Even before the legislation’s passage, AHA, along with the Partnership to Amend 42 CFR Part 2, has for several years advocated for these changes.

The proposed amendments would: modify and add new patient rights regarding consent and redisclosure of patient records, prohibitions on discrimination, and Notice of Privacy Practices under HIPAA; streamline requirements for patient consent for use and disclosure of Part 2 records; and create within HHS new enforcement authority.

What You Can Do

• Share this bulletin with the appropriate members of your leadership teams
• Review previous work from AHA on 42 CFR Part 2, including our 2020 letter to HHS regarding implementation of the related CARES Act provisions
• Submit to HHS comments on the rule by Jan. 31, 2023, at www.regulations.gov

Summary of Major Provisions

In this proposed rule, HHS seeks to revise, delete, replace or add regulatory language to the Part 2 regulations to align them with those under HIPAA, as well as to improve clarity or readability. The agency notes that it will issue a separate rule on CARES Act provisions related to antidiscrimination prohibitions.

The following summarizes proposed amendments that would make substantive changes to rights or requirements, but does not list all proposed provisions, i.e., this summary excludes provisions that would make editorial or typographical updates rather than policy changes.

Definitions. HHS proposes to add thirteen defined regulatory terms and modify the definitions of ten existing terms referenced in the Part 2 regulations. Most of these terms and definitions would be based on existing HIPAA regulatory terms and definitions; others would be modified for clarity and consistency. Generally, the agency proposes to define “HIPAA” and “HIPAA regulations” as encompassing statutory and regulatory provisions pertaining to privacy, security, breach notification and enforcement standards with respect to protected health information only; the definition would exclude other HIPAA standards not relevant to the rule (for example, standard electronic transitions or code sets).

Patient Rights. In order to protect against inappropriate use or disclosure of Part 2 records, HHS also proposes new patient rights, restrictions on redisclosures and protections against use of Part 2 records in legal proceedings. Specifically, the agency would:

• create the right to an accounting of disclosures using a standard that mirrors the HIPAA Privacy Rule;
• create the right to request restrictions on otherwise permitted disclosures;
• require Part 2 programs to establish a process to receive complaints of Part 2 violations, prohibit these programs from taking adverse action against patients who file complaints, and prohibit these programs from requiring individuals to waive their right to file a complaint as a condition of service;
• and expand and clarify prohibitions on the use of Part 2 records in legal proceedings without court order or patient consent.

Consent for Redisclosure. HHS proposes to streamline requirements to obtain patient consent to disclose Part 2 records. Specifically, the agency would permit:

• Part 2 programs to use and disclose Part 2 records for the purposes of all future treatment, payment and health care operations based on a single patient consent, rather than obtaining consent upon each disclosure (patients would have the right to revoke this consent in writing); and
• redisclosure of Part 2 records in any manner permitted under the HIPAA Privacy Rule (with some exceptions).

Enforcement. The agency proposes to extend enforcement mechanisms created and implemented through HIPAA and the HITECH Act to Part 2 violations. Specifically, HHS would create enforcement authority for itself to impose civil monetary penalties for violations.

Standards. HHS also proposes to apply existing standards under HIPAA and HITECH to Part 2 programs, including standards for:

• breach notification;patient notice of confidentiality; and
• de-identification of data for research.

HHS also would update the HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records.

Effective and Compliance Dates. Finalized provisions will be effective 60 days after the publication of the final rule. However, the compliance date – the date by which entities subject to the rule must establish and implement policies and practices to achieve compliance – would not occur until 22 months after the effective date. In other words, even if all provisions are finalized as proposed, current Part 2 regulations will remain in effect until 2025.

Further Questions

If you have further questions, please contact Caitlin Gillooley, AHA’s director of behavioral health and quality policy, at cgillooley@aha.org or 202-626-2267.